waf-validator-skills

WAF Rule Validator - Tool for testing and validating WAF security rules

This skill is essentially documentation/instructions for GoTestWAF and a Docker image (wallarm/gotestwaf). Before using it: 1) Confirm you have explicit legal authorization to run security tests against any target (unauthorized scanning is illegal). 2) Verify the upstream project/image (wallarm/gotestwaf) and, if possible, inspect source code or the Docker image provenance before executing. 3) Ensure Go 1.24, Docker, and optional Chrome are installed in an isolated/test environment to avoid accidental impact. 4) Because the skill can trigger network scans, avoid enabling autonomous invocation unless you trust the skill and its operator. 5) No secrets are requested by the skill, but do not supply unrelated credentials when following its examples.

Type: OpenClaw Skill Name: waf-validator-skills Version: 1.0.0 The skill bundle provides instructions for an AI agent to build and operate GoTestWAF, a security tool designed to test Web Application Firewalls by generating and sending malicious payloads (e.g., SQL injection, XSS). While the behavior is aligned with the stated purpose of security validation, the skill involves high-risk activities such as local binary compilation, execution, and network-based attack simulation. Per the analysis criteria, these risky capabilities are classified as suspicious even if plausibly needed for the tool's function. No evidence of intentional malice, data exfiltration, or backdoors was found in SKILL.md or _meta.json.